The term “bean counter” is often used pejoratively to describe accountants who are overly focused on the numbers to the detriment of other important factors. In this case, however, I’m suggesting a much broader scope of where bean counters can be found. Bean counters can include CFOs, accountants, managers, business administrators, and private equity (PE or pure evil).

Growth and Characteristics

Bean counters have gained traction over the last 20 years as businesses have faced increasing pressure to maximize profits. As a result, bean counters have become more influential in decision-making processes, often wielding significant power over strategic initiatives and, in some cases, effectively running the organization.

This bean counter’s ascent has resulted in many negative impacts on business.

Inhibition of innovation—Bean counters tend to focus on the bottom line and are often completely opposed to supporting ventures that may involve upfront costs. This hinders innovation and stifles the development of new products or services.

Short-term focus—Bean counters produce short-term reports, which leads to a short-term mindset. This incentivizes businesses to prioritize immediate gains over long-term growth and sustainability, potentially sacrificing investments in research and development, customer satisfaction, and employee morale.

Lack of business acumen—Bean counters are experts in compiling numbers, including finances, schedules, sales, hours, etc., but they lack a broader understanding of business strategy and operations. This can lead to decisions based solely on metrics (i.e., management by spreadsheet) without considering the potential impact on areas of the business such as brand reputation, customer satisfaction, quality, innovation, performance, employee morale, and cybersecurity.

Stifling of entrepreneurial spirit—Bean counters discourage entrepreneurial risk-taking by emphasizing the importance of financial stability and predictability. This can create a culture of fear and caution, limiting the potential for groundbreaking ideas and disruptive innovations.

Lack of standing—Bean counters feel they have expertise in all subjects, as numbers are involved at some level, and that’s all that matters to a bean counter. This could not be further from the truth, and, in my experience, bean counters usually have the least experience in other areas of the organization. They typically lack understanding of engineering, operations, sales, marketing, or infrastructure security. This results in complex topics, which are not easily reduced to a spreadsheet, being ignored or actively sabotaged.

Bean Counter Roles

As bean counters can occupy different roles, some of these roles can prove more disastrous than others, such as CFO, project manager, or PE.

CFOs are pretty obvious and are almost an expected place to find a bean counter, as that position is filled with what amounts to a “senior accountant.” Unfortunately, this is one of the most common roles to exhibit the “lack of standing” impact as previously described. After being told “no” by a CFO for a minor expense to garner increased income, the CEO of the same company told me, “That’s why I hired him—to say no” completely without any awareness of the financial upside or any other property of the purchase. 

Project managers (PM) are a fairly recent aberration to occur in business. A skilled PM can ensure projects are completed on time and within budget. However, when PMs lack the necessary skills and experience, the consequences can be severe. These PMs are frequently the result of other bean counters who don’t want to pay for a skilled PM. Instead, a PM with none of the desired characteristics is installed. This is a fairly common event primarily performed by CFOs and PE. 

Twenty years ago, a different role—product manager—was present and very valuable to the organization as well as profits. Product managers were compensated based on the success of the company’s products in their portfolio. This ensured the product manager would do everything in their power to ensure the success of the products. This included:

• Defining the product vision and strategy
• Understanding customer needs and market trends
• Prioritizing features and roadmaps
• Collaborating with cross-functional teams (e.g., design, engineering, security, marketing, sales)
• Ensuring the product meets market requirements and delivers value via a quality product
• Leadership

This required a skilled product manager who focused on product attributes that matter to success, as opposed to tracking numbers in a spreadsheet. Bean counters don’t see any value in a product manager, so this position has become an endangered role in medical device companies.

Identifying a Bean Counter

Bean counters often display common attributes that can help you identify them in your company. A bean counter never provides activities or information that result in a better product (mainly because they have no knowledge of what these improvements could be).

A frequently exhibited attribute for a bean counter is demanding that others do the bean counter’s job, such as providing activities, hours, dates, or percentage of completion of a task or project. They may even go so far as to ask for Gantt charts to be updated by the people who are performing the work. This would be akin to a software engineer asking an accountant to write a program. 

Another common trait demonstrated by bean counters is that anything they demand from others has to be the top priority, usually needing to be performed immediately.

Finally, bean counters are never responsible for the chaos and issues they create. Ultimately, it is someone else (frequently someone who wasn’t involved at all) who catches the blame.

Private Equity

Private equity is the ultimate evolution of a bean counter, caring only about short-term financial gains at the expense of all other considerations including the survival or profitability of the company.

Investment in or purchase of a company by PE will almost certainly result in the destruction of that organization. There are many, well-documented examples of this,¹ yet there is a continuous stream of companies that fall victim to these predators.

When there is a preponderance of bean counters at your organization or PE involvement, there is most likely not going to be a positive outcome for the company, employees, or its customers. For example, look at Red Lobster,² Boeing Starliner,³ or 737 Max⁴ for examples. It becomes much more likely that the company will not survive, or if it does, it will be following a large shakeup in senior management where the majority of the bean counters are removed from the company (unfortunately, this cannot be counted on to occur).

The Cybersecurity Tie-in

How does all of this interact with cybersecurity? As you may have guessed by now, this is not going to be good for cybersecurity activities at any level. There are a number of outcomes that can be anticipated from the influence of bean counters on cybersecurity activity.

Underinvestment in security—When bean counters prioritize cost-cutting, they will usually allocate insufficient funds for cybersecurity mitigating controls. This can leave organizations and their products vulnerable to attacks that could result in significant financial losses, reputational damage, and legal liabilities.

Short-term focus—This can lead to a reluctance to invest in long-term cybersecurity initiatives that may not yield immediate or obvious returns. Bean counters mistakenly believe a breach will not occur to them or their organization. Frequently, the word “likelihood” is used by the bean counters to justify doing nothing.

Prioritization of known risks—Bean counters may be more likely to prioritize known risks that can be quantified and measured, such as compliance violations or insurance premiums. This can lead to a neglect of emerging security issues or less tangible risks that may pose a significant threat to the organization.

Resistance to change—Especially true if it involves additional costs or complexity. This can hinder the adoption of new cybersecurity technologies or practices essential for protecting against evolving threats.

Lack of understanding of cybersecurity risks—Bean counters do not have a deep understanding of cybersecurity threats and vulnerabilities (or really anything else), nor a desire to learn more about cybersecurity. This can result in resources not being allocated accordingly.

What can you do? Unfortunately, probably not enough to be effective, but some combination of the following may help.

• Educate the Board of Directors by providing training and education to the board about cybersecurity risks, threats, and best practices. If the board responds, this can defeat a lot of bean counter inactivity. This assumes the board has not been taken over by bean counters, such as PE.
• Position cybersecurity as a strategic investment in the company (rather than a cost center) to help justify adequate funding and support. This will probably not work, but professional ethics demand you at least try.
• Measure cybersecurity performance by creating metrics and KPIs to measure the effectiveness of cybersecurity initiatives, allowing for a more data-driven approach to decision making. OWASP’s SAMM is an excellent tool for performing this.

If nothing works, perhaps consider finding a company interested in protecting itself and its customers. Do you really want to work at a company when you know it is only a matter of time before it is devastated by an attack?

In the next column, I will be addressing a related issue and one where the solution may be applicable to bean counter-infested companies as well.

References

¹ tinyurl.com/mpo250181
² tinyurl.com/mpo250182
³ tinyurl.com/mpo250183
⁴ tinyurl.com/mpo250184

MORE FROM THIS AUTHOR: Human-Readable SBOMs in Medtech

Christopher Gates is the director of Product Security at Velentium and the current co-chair for H-ISAC’s MDSC. He has more than 50 years of experience developing and securing medical devices and works with numerous industry-leading device manufacturers. He frequently collaborates with regulatory and standard bodies, including the CSIA, Health Sector Coordinating Council, H-ISAC, and Bluetooth SIG.